Security incident write-ups and practical field notes. We publish when there's something worth saying, not on a schedule.
April 30, 2026 · 5 min read
Two malicious versions of the PyTorch lightning training package activate silently on import, sweeping developer credentials, cloud provider secrets, cryptocurrency wallets, and CI pipeline tokens from the affected machine.
April 29, 2026 · 9 min read
A preinstall hook in four SAP packages drops an 11.7 MB credential stealer onto developer machines and CI runners, targeting cloud secrets, GitHub tokens, and Actions secrets.
March 31, 2026 · 10 min read
The lead axios maintainer's npm account was hijacked and two malicious versions deployed a cross-platform RAT via a pre-staged dropper package. With ~100M weekly downloads, this is among the most impactful supply-chain attacks on record.